|
When importing a local certificate under System Settings -> Certificates does not work because the certificate was created with a newer OpenSSL version that FortiManager/FortiAnalyzer does not yet support.
Importing certificate Error will be something like 'Importing local certificate failed. It might already exist'.
Here is a step-by-step procedure on a Linux PC using Linux commands to convert and export the certificate so it can be successfully uploaded to FortiManager/FortiAnalyzer.
ubuntu@ubuntu1910:~/Documents$ mkdir legacy_folder
ubuntu@buntu1910:~/Documents$ openssl pkcs12 -in <CERTIFICATE_NAME>.pfx -out legacy_folder/key.pem -nocerts -nodes -legacy
Enter Import Password:
ubuntu@ubuntu1910:~/Documents$ openssl pkcs12 -in <CERTIFICATE_NAME>.pfx -out legacy_folder/cert.pem -nokeys -nodes -legacy
Enter Import Password: xxxxxx
ubuntu@ubuntu1910:~/Documents$ openssl rsa -in legacy_folder/key.pem -out key_legacy_new.pem
writing RSA key
ubuntu@ubuntu1910:~/Documents$ openssl pkcs12 -export -out legacy_version.pfx -inkey key_legacy_new.pem -in legacy_folder/cert.pem
Enter Export Password: xxxxxx
Verifying - Enter Export Password: xxxxxx
Once the certificate is converted to the legacy format, it can then be uploaded to FortiManager/FortiAnalyzer under System Settings -> Certificates -> Create New/Import.
---------------------
Note:
When a user receives a certificate in .cer format along with a private key protected by a password, it is necessary to convert it to a .pfx file.
To create a .pfx file (also known as a .p12 file) from a .cer (certificate) file and a private key, OpenSSL can be used. This command combines the certificate and its corresponding private key into a single, password-protected file — often required for server deployments or for importing into other systems.
Example command:
$ openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.cer
[Enter Export Password: xxxxxxx
Verifying - Enter Export Password: xxxxxx
Explanation of the command:
- openssl pkcs12: Uses the OpenSSL tool to handle PKCS#12 format files (.pfx/.p12).
- -export: Tells OpenSSL to export the certificate and private key into a new .pfx file.
- -out certificate.pfx: Specifies the name and location of the output .pfx file (for example, certificate.pfx).
- -inkey privateKey.key: Specifies the path to the private key file (for example, privateKey.key).
- -in certificate.cer: Specifies the path to the certificate file (for example, certificate.cer).
|
